Formjacking
Injecting script into a checkout or login page so that what the visitor types is copied to the attacker as they type it. The form still works, the transaction still completes, and nothing on the page looks wrong.
Why it matters to you
Server logs will not show this, because the theft happens in the browser and never touches your backend. The controls that see it are client side: subresource integrity, a content security policy that names what may execute, and a record of which scripts your checkout page actually loads today.
Where we meet it
The injection usually arrives through something the site chose to include: an analytics tag, a chat widget, a payment helper loaded from a third party. Compromising one supplier reaches every site that embeds it, which is what makes the technique worth the effort.
Connected terms
Card dump
The magnetic-stripe data read off a payment card, sold for cloning into a physical one. Distinct from card-not-present data, priced higher, and slowly becoming a legacy good as chip and contactless spread.
CVV
Card-not-present data: number, expiry, security code and usually the billing address, sold per record for online use. The bulk commodity of card fraud, priced by country, issuer and freshness.
Malvertising
Buying advertising to deliver the lure: a paid result above the real one, pointing at a page that looks like the software the visitor searched for. Distribution with a budget and a targeting console.
Read elsewhere
Where this term stops being vocabulary
Malveine is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the playbook
Adversary-in-the-middle phishing
A phishing page that proxies the real login instead of imitating it. The victim authenticates against the genuine site through the attacker's server, completes multi-factor as normal, and the attacker keeps the resulting session cookie.
Business Email Compromise (BEC)
Fraud committed from inside a real mailbox: the attacker reads the thread, waits for an invoice and answers it with different bank details. No malware, no attachment, nothing for a scanner to find.
Callback phishing
An email that carries no link and no attachment, only a plausible invoice or subscription notice and a phone number to dispute it. The attack begins when the victim calls, and the person who answers walks them into installing remote access software.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.